recover partition table
Geronimo
recently I wiped out all but one partition tables by stupidness and hasty
reading ...
Thanks to testdisk, most of the damage is already fixed.
There are 2 drives, that testdisk could not find the partion informations for.
Accidently I discovered "/var/log/installer/partman", which looks like being
from the time before my dumb Chuck-Norris-Roundhouse-Kick ;)
That logfile looks like having reasonable partition informations of all drives.
Can anybody please shine me a light, how to patch the partition tables with
informations from that file, so it might be possible to gain access to data ...
kind regards
Gero
--
To UNSUBSCRIBE, email to debian-us...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listm...@lists.debian.org
Archive: http://lists.debian.org/201103261137.44...@arcor.de
Hans-J. Ullrich
> Hello,
>
> recently I wiped out all but one partition tables by stupidness and hasty
> reading ...
>
> Thanks to testdisk, most of the damage is already fixed.
>
> There are 2 drives, that testdisk could not find the partion informations
> for. Accidently I discovered "/var/log/installer/partman", which looks
> like being from the time before my dumb Chuck-Norris-Roundhouse-Kick ;)
>
> That logfile looks like having reasonable partition informations of all
> drives.
>
> Can anybody please shine me a light, how to patch the partition tables with
> informations from that file, so it might be possible to gain access to data
> ...
>
>
> kind regards
>
> Gero
maybe you can fix it, when you use fdisk, delete all partitions and create
exactly the same partitions withe the exactly size as before. But do NOT
formate!!!
This worked for me, when I accidently loosing my partitions by using a mirror
tool from windows.
I lost my ext3 partitions that day.
Maybe another option, to rescue data might be using the tool "dd",but I am not
experienced with it.
Testdisk might also be able to rescue the partitions. Another good tools are
on SuperRescueCD or UltimatebootCD for Windows. Google for it.
Good luck
Hans
--
To UNSUBSCRIBE, email to debian-us...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listm...@lists.debian.org
Geronimo
thank your for your assistance.
Hans-J. Ullrich wrote:
> Am Samstag, 26. März 2011 schrieb Geronimo:
> > Can anybody please shine me a light, how to patch the partition tables
> > with informations from that file, so it might be possible to gain access
> > to data ...
> >
> maybe you can fix it, when you use fdisk,
Not sure about fdisk. Does fdisk write partition table entry only?
... or does it have side effects on existing data - like wiping out superblock
of existing fs, so you have to format the partition?
I don't want to increase the damage, therefore I ask before doing anything.
kind regards
Gero
--
To UNSUBSCRIBE, email to debian-us...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listm...@lists.debian.org
Archive: http://lists.debian.org/201103261459.20...@arcor.de
Stephen Powell
>
> recently I wiped out all but one partition tables by stupidness and hasty
> reading ...
>
> Thanks to testdisk, most of the damage is already fixed.
>
> There are 2 drives, that testdisk could not find the partion informations for.
> Accidently I discovered "/var/log/installer/partman", which looks like being
> from the time before my dumb Chuck-Norris-Roundhouse-Kick ;)
>
> That logfile looks like having reasonable partition informations of all drives.
>
> Can anybody please shine me a light, how to patch the partition tables with
> informations from that file, so it might be possible to gain access to data ...
I looked at my /var/log/installer/partman file, and it does indeed look as
though the exact sector information for the partitions is there. I would suggest
using the "parted" command from the package of the same name. It can allocate
partitions and report on them at the sector level. For example,
parted /dev/sda unit s print free
parted /dev/sda unit s mkpart ...
--
.''`. Stephen Powell
: :' :
`. `'`
`-
--
To UNSUBSCRIBE, email to debian-us...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listm...@lists.debian.org
Archive: http://lists.debian.org/2015154596.1732737.1301...@md01.wow.synacor.com
Stephen Powell
>
> Not sure about fdisk. Does fdisk write partition table entry only?
>
> ... or does it have side effects on existing data - like wiping out superblock
> of existing fs, so you have to format the partition?
> I don't want to increase the damage, therefore I ask before doing anything.
That's an excellent point, Geronimo. Sometimes partitioning programs do
stuff like that. I know the old FDISK command from MS-DOS used to write out
a few blocks of binary zeros to each partition it allocated to avoid
left-over data from causing problems. In the case of Linux fdisk, parted,
etc. I don't know the answer to that question. One thing you can try is
to allocate a small partition in an area that you know was free space,
format it, put some data in it, delete the partition, then reallocate it
exactly where it was before, and see if you can still read the data. Then
delete the partition again.
--
.''`. Stephen Powell
: :' :
`. `'`
`-
--
To UNSUBSCRIBE, email to debian-us...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listm...@lists.debian.org
Archive: http://lists.debian.org/350791612.1732927.1301...@md01.wow.synacor.com
Hans-J. Ullrich
> Hello,
>
> thank your for your assistance.
>
> Hans-J. Ullrich wrote:
> > Am Samstag, 26. März 2011 schrieb Geronimo:
> > > Can anybody please shine me a light, how to patch the partition tables
> > > with informations from that file, so it might be possible to gain
> > > access to data ...
> >
> > maybe you can fix it, when you use fdisk,
>
> Not sure about fdisk. Does fdisk write partition table entry only?
>
> ... or does it have side effects on existing data - like wiping out
> superblock of existing fs, so you have to format the partition?
> I don't want to increase the damage, therefore I ask before doing anything.
>
>
> kind regards
>
> Gero
changing data and formation. So do NOT formate under any circumstances.
As I wrote, I got success without loosing any data by jusdt rewriting a new
partition table. If this is working in your case, I cannot grant. But maybe
other people got some better ideas.
Have fun!
Greetz
Hans
--
To UNSUBSCRIBE, email to debian-us...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listm...@lists.debian.org
Geronimo
thank you all for your attention and assistance.
Stephen Powell wrote:
> On Sat, 26 Mar 2011 06:37:44 -0400 (EDT), Geronimo wrote:
> > That logfile looks like having reasonable partition informations of all
> > drives.
> >
> > Can anybody please shine me a light, how to patch the partition tables
> > with informations from that file, so it might be possible to gain access
> > to data ...
>
> I looked at my /var/log/installer/partman file, and it does indeed look as
> though the exact sector information for the partitions is there.
I'm a bit confused.
I tried to read partition info from hex-dump of first block and compare that
with the values from /var/log/installer/partman ...
According to partition info from wiki the biggest number of chs is 0x3FF,
which is 1023 decimal - and partman output contains entries like:
(91201,0,0) (91201,80,62)
So is there another way to interpret entries from partition table?
kind regards
Gero
--
To UNSUBSCRIBE, email to debian-us...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listm...@lists.debian.org
Archive: http://lists.debian.org/201103261736.08...@arcor.de
Stephen Powell
>
> I'm a bit confused.
>
> I tried to read partition info from hex-dump of first block and compare that
> with the values from /var/log/installer/partman ...
>
> According to partition info from wiki the biggest number of chs is 0x3FF,
> which is 1023 decimal - and partman output contains entries like:
> (91201,0,0) (91201,80,62)
>
> So is there another way to interpret entries from partition table?
The master boot record is the first sector of the disk (512 bytes).
Its LBA value is 0 and its CHS value is 0:0:1 (cylinder 0, head 0, record 1).
The partition table is contained within the master boot record.
Assuming that your disk is partitioned using the standard MS-DOS
disk partitioning scheme, the partition table is at offset 0x1be
(decimal 446). The total size of the partition table is 64 bytes.
It consists of four 16-byte entries.
Each entry describes a primary partition or an extended partition.
There can be a maximum of one (minimum of zero) extended partitions.
Logical partitions, if any, are described in the extended partition
table in the first sector of the extended partition. See, for example,
http://en.wikipedia.org/wiki/Master_boot_record
for more details.
Each partition table entry contains the starting sector of the
partition in both CHS format and LBA format. It also contains the
total number of sectors in the partition and the CHS address of
the last sector in the partition. LBA values and CHS values can
be converted back and forth to each other as long as (1) the
disk geometry is known, and (2) the partition is completely
contained within the portion of the disk which is addressable
in CHS format. In the best case scenario, CHS values can address
only the first 8.4G of the disk. The LBA values can address up
to 2T (2 terabytes).
Unfortunately, not all disk partitioning programs agree on the
disk geometry; so what to use for LBA values depends on which
program was used to partition the disk. I address this topic
to some extent in my LILO web page
http://users.wowway.com/~zlinuxman/lilo.htm
That's why I recommend that you concentrate on the sector numbers,
which are essentially the same as LBA values. The sector information
is further down in the file than the CHS information.
--
.''`. Stephen Powell
: :' :
`. `'`
`-
--
To UNSUBSCRIBE, email to debian-us...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listm...@lists.debian.org
Archive: http://lists.debian.org/2008653358.1735863.1301...@md01.wow.synacor.com
Geronimo
Stephen Powell wrote:
> On Sat, 26 Mar 2011 12:36:08 -0400 (EDT), Geronimo wrote:
> > I'm a bit confused.
> >
> > I tried to read partition info from hex-dump of first block and compare
> > that with the values from /var/log/installer/partman ...
> >
> > According to partition info from wiki the biggest number of chs is 0x3FF,
> >
> > which is 1023 decimal - and partman output contains entries like:
> > (91201,0,0) (91201,80,62)
> >
> > So is there another way to interpret entries from partition table?
>
> The master boot record is the first sector of the disk (512 bytes).
> ...
> is further down in the file than the CHS information.
I don't want to offend you, but all that you wrote I already found from google
and friends.
What I did not find is some info about partman logging.
Searching debian MLs for partman has millions of hits, so its the same like no
hits - can't read all that.
As partman is internal to d-i, where can I find some info about the numbers
shown around partition informations?
You wrote, that disc addressing could be converted, if size is smaller than 8
Gig - none of my partitions fits this condition, so how can I calculate a
sector from informations of partman log?
kind regards
Gero
--
To UNSUBSCRIBE, email to debian-us...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listm...@lists.debian.org
Archive: http://lists.debian.org/201103261842.15...@arcor.de
Vivek Periaraj
> Can anybody please shine me a light, how to patch the partition tables
> with informations from that file, so it might be possible to gain
> access to data ...
This may not be what you are looking for, but if your aim is to get the
partition table back, did you try this utility 'gpart', which guesses
the partition table using the device name. It helped me sometime back.
Hope it does right in your case :)
Regards,
Vivek.
--
To UNSUBSCRIBE, email to debian-us...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listm...@lists.debian.org
Archive: http://lists.debian.org/alpine.DEB.2.00.1...@xnqqnccn.tnynkl.pbz
Stephen Powell
>
> I don't want to offend you, but all that you wrote I already
> found from google and friends.
>
> What I did not find is some info about partman logging.
> Searching debian MLs for partman has millions of hits,
> so its the same like no hits - can't read all that.
>
> As partman is internal to d-i, where can I find some info
> about the numbers shown around partition informations?
Sorry. I guess I didn't understand what you were asking for.
In answer to your question, probably nowhere. But I can make
some educated guesses. For example, here's an excerpt from my
/var/log/installer/partman file:
-----
.
.
.
/lib/partman/choose_partition/35crypto/choices: IN: PARTITIONS =dev=hda
parted_server: Read command: PARTITIONS
parted_server: command_partitions()
parted_server: Opening outfifo
parted_server: OUT: OK
parted_server: OUT: 1 32256-526417919 526385664 primary linux-swap
/dev/hda1
parted_server: OUT: 2 526417920-37523727359 36997309440 primary ext3
/dev/hda2
parted_server: OUT: 3 37523727360-39999536639 2475809280 primary ext3
/dev/hda3
parted_server: Partitions printed
.
.
.
-----
The first number after "OUT" is probably the partition number.
Next is two numbers separated by a hyphen. I'm guessing that that
is the starting and ending sector numbers. Then comes a third
number. I'm guessing that that is the total number of sectors
in the partition. Next comes the partition type (primary) and
the type of file system in the partition (ext3). Now if my
guesses are correct, then the ending sector number minus the
starting sector number plus one should equal the number of sectors
in the partition. Let's see. Hmm. Yes, the math holds up in
all the above examples. Let's double check that with the current
output of "parted /dev/sda unit s print free". Hmm. No, these
are not sector numbers, these are byte offsets. Converting them
to sector numbers gives
1 63-1028159 1028097 primary linux-swap
2 1028160-73288529 72260370 primary ext3
3 73285530-78124094 4835565 primary ext3
And this agrees with the output of "parted /dev/sda unit s print free".
(To convert the starting byte offset to the starting sector number,
simply divide by 512. The same procedure works to convert the number
of bytes to the number of sectors: simply divide by 512. To convert
an ending byte offset to an ending sector number, the formula is a
little more complicated: add 1, divide by 512, then subtract 1.)
The corresponding commands to create these partitions would be:
parted /dev/sda unit s mkpart primary linux-swap 63 1028159
parted /dev/sda unit s mkpart primary ext3 1028160 73288529
parted /dev/sda unit s mkpart primary ext3 73285530 78124094
It's a "seat of the pants" kind of thing. You won't likely find any
official documentation on it.
Hmm. I just discovered a "rescue" command in parted. It's
description is "rescue a lost partition". The corresponding syntax
for "rescue" is
parted /dev/sda unit s rescue 63 1028159
parted /dev/sda unit s rescue 1028160 73288529
parted /dev/sda unit s rescue 73285530 78124094
I would think "rescue" would be safer to use than "mkpart".
Obviously if you're going to rescue a partition, you wouldn't
want any blocks of binary zeros written to the beginning, now
would you? Of course, you only want to "rescue" partitions
that are not already defined. And rescuing a partition may
change the numbers of existing partitions, so watch out for
that.
--
.''`. Stephen Powell
: :' :
`. `'`
`-
--
To UNSUBSCRIBE, email to debian-us...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listm...@lists.debian.org
Archive: http://lists.debian.org/2146860404.1737077.1301...@md01.wow.synacor.com
Rob Owens
> Hello,
>
> thank your for your assistance.
>
> Hans-J. Ullrich wrote:
> > Am Samstag, 26. März 2011 schrieb Geronimo:
> > > Can anybody please shine me a light, how to patch the partition tables
> > > with informations from that file, so it might be possible to gain access
> > > to data ...
> > >
> > maybe you can fix it, when you use fdisk,
>
> Not sure about fdisk. Does fdisk write partition table entry only?
>
> ... or does it have side effects on existing data - like wiping out superblock
> of existing fs, so you have to format the partition?
> I don't want to increase the damage, therefore I ask before doing anything.
>
steps that you're not sure of.
-Rob
--
To UNSUBSCRIBE, email to debian-us...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listm...@lists.debian.org
Archive: http://lists.debian.org/20110326213...@aurora.owens.net
Geronimo
Stephen Powell wrote:
> On Sat, 26 Mar 2011 13:42:15 -0400 (EDT), Geronimo wrote:
> > I don't want to offend you, but all that you wrote I already
> > found from google and friends.
>
> ... But I can make some educated guesses. For example, here's an excerpt
> from my /var/log/installer/partman file:
> ...
> The first number after "OUT" is probably the partition number.
As in my partman log there where millions of OUT - lines, I focussed to the
lines that look quit similar to fdisk output, like:
========== <snip> ===============
Model: ATA INTEL SSDSA2M040
Path: /dev/sdd
Sector size: 512
Sectors: 78165360
Sectors/track: 63
Heads: 255
Cylinders: 4865
Partition table: yes
Type: msdos
Partitions: # id length type fs path name
(0,0,0) (0,0,62) -1 0-32255 32256 primary label /dev/sdd-1
(0,1,0) (2611,254,62) 1 32256-21484431359 21484399104 primary ext4
/dev/sdd1
(2612,0,0) (2612,27,38) -1 21484431360-21485322239 890880 pri/log
free /dev/sdd-1
(2612,27,39) (2660,173,8) 2 21485322240-21884829695 399507456 primary
ext3 /dev/sdd2
(2660,173,9) (4865,122,56) 3 21884829696-40019951615 18135121920 primary
ext4 /dev/sdd3
(4865,122,57) (4865,144,62) -1 40019951616-40020664319 712704 pri/log
free /dev/sdd-1
========== <snap> ===============
... and these lines confused me, as wiki said, that biggest value from chs is
1023 - and for me the values in round brakets looked like chs values.
As I'm no hero in juggling hex numbers by mind, I wrote a little helper, that
dumped the mbr infos.
Trying then your advice with "parted -I" I got values similar to the output of
my dumper, but not matching the values from partman, so I came to the same
conclusion as you - where I had to look at the man pages of parted to find a
smaller unit than sectors.
So I added little math to my dumping tool and finally the values matched.
From manual I already read about the rescue option and as you recommended the
same, I gave it a try.
... but I got an error, about missing or wrong label. - Huh?
Did not used any label yet.
So I added writing capabilities to my dumper and created a mbr, where I
thought, should match. Then I wrote it to the drives mbr using dd and rebooted
...
Voila - drive is recognized and all works well.
Thank you very much for your patience and assistance.
kind regards
Gero
P.S. on writing my dumper and checking all drives against partman log, may be
I found a little bug from partman (don't know, whether it has any relevance):
According to wiki, head and cylinder are 0-based, whereas sector is 1-
based. So I think, a value of (0, 1, 0) as above is invalid and should not
occure. I happen to notice 0-based sectors on every drive.
--
To UNSUBSCRIBE, email to debian-us...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listm...@lists.debian.org
Archive: http://lists.debian.org/201103271453.52...@arcor.de